okengine 0.22.0 → 0.23.0

package/src/console/ui-next/dist/assets/vault-page-B54v4Yit.js

@@ -0,0 +1,2 @@
+import{r as e}from"./rolldown-runtime-hePW80VL.js";import{r as t}from"./react-dom-Ddte4I-Q.js";import{A as n}from"./xyflow-yApv7D4e.js";import{$n as r,Cr as i,E as a,Qn as o,_ as s,b as c,c as l,d as u,er as d,h as f,i as p,l as m,o as h,p as g,s as _,u as v,x as y,y as b}from"./shortcut-keys-DTE1sjTC.js";import{At as x,C as S,D as C,Dt as w,E as T,Et as E,O as D,S as ee,W as te,_ as O,a as ne,b as re,c as ie,d as ae,f as k,g as oe,i as se,jt as ce,kt as le,m as ue,o as A,p as j,r as de,s as M,w as N,x as P}from"./explorer-chrome-Dslh2yE8.js";import{a as fe,b as pe,c as F,h as me,i as he,m as ge,n as _e,o as ve,r as ye,s as I,t as L,v as R,x as be}from"./element-icons-C6t8Vlml.js";import{a as z,i as xe,n as Se,o as Ce,r as we,s as B,t as Te}from"./collapsible-BY03SeCg.js";import{t as Ee}from"./FileExportIcon-Ck-5od4R.js";import{t as De}from"./MoreHorizontalCircle01Icon-gMNGsE37.js";import{n as Oe,t as ke}from"./copy-inline-button-BTjPVjRT.js";import{t as Ae}from"./UnavailableIcon-D9cvHVPr.js";import{a as V,d as je,i as Me,l as Ne,r as Pe,t as Fe}from"./dropdown-menu-CRGrj5JU.js";import{Mt as Ie,jt as Le,xt as Re}from"./index-C0lc_s9d.js";import{t as ze}from"./explorer-empty-CIVg7Jgb.js";import{a as H,c as U,l as W,n as G,o as Be,s as Ve,t as He}from"./detail-header-Dk5LipF6.js";import{t as Ue}from"./confirm-sheet-DZfuJXP4.js";import{a as We,i as Ge,n as Ke,o as qe,r as Je,s as Ye,t as Xe}from"./use-vault-list-BAyQG8Re.js";var Ze=[[`path`,{d:`M16 21C15.7668 18.0685 13.3422 15.7477 10.3085 15.5521L9.49999 15.5C9.21121 15.5076 8.94209 15.5178 8.68816 15.5298C5.68124 15.6723 3.23089 18.0974 3 21`,stroke:`currentColor`,strokeLinecap:`round`,strokeLinejoin:`round`,strokeWidth:`1.5`,key:`0`}],[`path`,{d:`M12.75 9.75C12.75 11.5449 11.2949 13 9.5 13C7.70508 13 6.25 11.5449 6.25 9.75C6.25 7.95507 7.70508 6.5 9.5 6.5C11.2949 6.5 12.75 7.95507 12.75 9.75Z`,stroke:`currentColor`,strokeLinecap:`round`,strokeLinejoin:`round`,strokeWidth:`1.5`,key:`1`}],[`path`,{d:`M21 17.501C20.7709 14.6314 18.4541 12.2748 15.5 11.9961`,stroke:`currentColor`,strokeLinecap:`round`,strokeLinejoin:`round`,strokeWidth:`1.5`,key:`2`}],[`path`,{d:`M15.9877 9C16.8965 8.42434 17.5001 7.40788 17.5001 6.25C17.5001 4.45507 16.0496 3 14.2602 3C13.3811 3 12.5838 3.35121 12.0001 3.92139`,stroke:`currentColor`,strokeLinecap:`round`,strokeLinejoin:`round`,strokeWidth:`1.5`,key:`3`}]],K=e(t(),1);function Qe(e){if(e.count===0)return{summary:`No in-flight durable runs hold this secret`,detail:null,warn:!1};let t=e.longestOutstandingMs==null?null:$e(e.longestOutstandingMs);return{summary:`${e.count} in-flight durable run(s) will wake holding a new key`,detail:t?`Longest outstanding wake in ${t}`:e.longestWakeAt==null?null:`Longest wake at ${new Date(e.longestWakeAt).toISOString()}`,warn:!0}}function $e(e){if(e<1e3)return`${e}ms`;let t=Math.floor(e/1e3);if(t<60)return`${t}s`;let n=Math.floor(t/60);if(n<60)return`${n}m`;let r=Math.floor(n/60);return r<48?`${r}h`:`${Math.floor(r/24)}d`}function et(e){return`await fx.vault.get(${e})`}function tt(e){return`oke vault set ${e}`}function nt(e){return`oke vault rotate ${e}`}function rt(e){return`${e}=`}function it(e,t,n){switch(e){case`process.env`:return{source:e,label:`env`,command:`export ${t}=`,hint:`Process environment for this Console process`};case`.env.local`:return{source:e,label:`local`,command:rt(t),hint:`Write to .env.local (gitignored)`};case`driver`:return{source:e,label:qe(n),command:tt(t),hint:Ge(n)};case`dev-fallback`:return{source:e,label:`fallback`,command:`dev: "…"`,hint:`Local-only option on the contract — never used in prod`}}}function at(e){return{name:e.name,kind:e.kind,sensitive:e.sensitive,description:e.description??null,rotate:e.rotate??null,fingerprints:{...e.fingerprints},fingerprint:e.fingerprint,cleartext:e.sensitive?null:e.cleartext,winner:e.winner,resolution:e.resolution.map(e=>({...e})),readers:[...e.readers],blastRadius:{count:e.blastRadius.count,longestWakeAt:e.blastRadius.longestWakeAt,longestOutstandingMs:e.blastRadius.longestOutstandingMs,runIds:[...e.blastRadius.runIds]},lastReadAt:e.lastReadAt,sharedFingerprintEnvs:[...e.sharedFingerprintEnvs]}}function ot(e){return JSON.stringify(e.map(e=>at(e)),null,2)}var st=[{id:`blast`,label:`Blast`,token:`blast`,tone:`danger`},{id:`unset`,label:`Unset`,token:`unset`,tone:`warn`},{id:`overdue`,label:`Overdue`,token:`overdue`,tone:`warn`},{id:`shared`,label:`Shared`,token:`shared`,tone:`warn`},{id:`dormant`,label:`Dormant`,token:`dormant`,tone:`neutral`}],ct=[`blast`,`unset`,`overdue`,`shared`,`dormant`];function lt(e){if(!e)return 0;let t=/^(\d+)(ms|s|m|h|d)$/.exec(e.trim());if(!t)return 0;let n=Number(t[1]);switch(t[2]){case`ms`:return n;case`s`:return n*1e3;case`m`:return n*6e4;case`h`:return n*36e5;case`d`:return n*864e5;default:return 0}}var ut=new Set([`never`,`none`,`off`]);function q(e){return lt(e)>0}function dt(e){if(q(e))return e.trim();let t=e?.trim().toLowerCase()??``;return t.length===0||ut.has(t)?`no rotate`:e.trim()}function ft(e){return e.sensitive?e.fingerprint!=null&&e.fingerprint.length>0:e.cleartext!=null&&e.cleartext.length>0}function pt(e,t){let n=ft(e),r=!n,i=e.blastRadius.count>0,a=e.sharedFingerprintEnvs.length>0,o=e.lastReadAt==null,s=e.kind===`secret`&&(o||e.lastReadAt!=null&&t-e.lastReadAt>=7776e6),c=lt(e.rotate),l=e.kind===`secret`&&n&&c>0&&(o||e.lastReadAt!=null&&t-e.lastReadAt>=c),u=[];return i&&u.push(`blast`),r&&u.push(`unset`),l&&u.push(`overdue`),a&&u.push(`shared`),s&&u.push(`dormant`),{unset:r,set:n,blast:i,shared:a,dormant:s,overdue:l,unread:o,healthy:n&&!i&&!a&&!s&&!l,risks:u,primary:e.kind===`config`&&!r&&!i&&!a?`config`:ct.find(e=>u.includes(e))??`healthy`}}function mt(e,t){let n=0,r=0,i=0,a=0,o=0,s=0,c=0,l=0;for(let u of e){u.kind===`secret`?n+=1:r+=1;let e=pt(u,t);e.unset&&(i+=1),e.blast&&(a+=1),e.shared&&(o+=1),e.dormant&&(s+=1),e.overdue&&(c+=1),e.healthy&&(l+=1)}return{total:e.length,secrets:n,config:r,unset:i,blast:a,shared:o,dormant:s,overdue:c,healthy:l}}function ht(e,t){let n=Math.max(0,t-e);if(n<6e4)return`just now`;if(n<36e5)return`${Math.floor(n/6e4)}m ago`;if(n<864e5)return`${Math.floor(n/36e5)}h ago`;let r=Math.floor(n/864e5);return r<14?`${r}d ago`:r<60?`${Math.floor(r/7)}w ago`:`${Math.floor(r/30)}mo ago`}function gt(e){switch(e){case`blast`:return`blast`;case`unset`:return`unset`;case`overdue`:return`overdue`;case`shared`:return`shared`;case`dormant`:return`dormant`;case`config`:return`config`;case`healthy`:return`set`}}function _t(e,t){switch(e){case`blast`:return`In-flight durable runs hold this secret`;case`unset`:return`No value in this environment`;case`overdue`:return t?`Last read older than rotate ${t} — never-read counts`:`Last read older than the rotate hint — never-read counts`;case`shared`:return`Fingerprint matches another environment`;case`dormant`:return`Unread for 90 days, or never`;case`config`:return`vault.config — shown in the clear`;case`healthy`:return`Set, no blast, no shared, not dormant`}}var J=`#94A3B8`,Y=n(),vt={driver:`driver`,"process.env":`env`,".env.local":`local`,"dev-fallback":`fallback`},yt={driver:me,"process.env":z,".env.local":R,"dev-fallback":Ae},bt=`text-emerald-700 dark:text-emerald-400`,xt=[`driver`,`process.env`,`.env.local`,`dev-fallback`];function St(e){let t=e.resolution.length>0?e.resolution:xt.map(t=>({source:t,present:!1,won:e.winner===t})),n=new Map(t.map(e=>[e.source,e]));return xt.map(t=>n.get(t)??{source:t,present:!1,won:e.winner===t})}function Ct(e){return e.find(e=>e.won)?.source??e.find(e=>!e.present)?.source??e[0].source}function wt(e,t,n){return e.won?`won`:n>=0&&t>n?e.present?`shadowed`:`skipped`:e.present?`shadowed`:`missed`}function Tt({row:e,env:t,now:n,backend:i=null,onSet:a,onRotate:o,onQueryChange:s,leading:c}){let l=Qe(e.blastRadius),u=pt(e,n),d=e.description??e.name,f=jt(e,t),p=St(e),m=p.find(e=>e.won)??null,[h,g]=(0,K.useState)(()=>Ct(p)),_=u.unset,v=u.overdue&&q(e.rotate)&&!l.warn&&!u.unset;(0,K.useEffect)(()=>{g(Ct(St(e)))},[e.name]);let b=p.find(e=>e.source===h)??p[0],x=it(b.source,e.name,i);return(0,Y.jsxs)(`div`,{className:`flex h-full min-h-0 flex-col overflow-y-auto`,"data-slot":`vault-detail`,"aria-label":`Vault detail`,"aria-live":`polite`,children:[(0,Y.jsx)(He,{dataSlot:`vault-detail-header`,leading:c,icon:(0,Y.jsx)(r,{icon:L.vault.icon,className:`size-4`}),wellStyle:{color:J},title:d,badge:(0,Y.jsxs)(Y.Fragment,{children:[(0,Y.jsx)(`span`,{className:`font-mono text-[10px] font-medium tracking-[0.08em] text-muted-foreground uppercase`,children:e.kind}),e.kind===`secret`?(0,Y.jsx)(`span`,{className:`font-mono text-[10px] text-muted-foreground`,children:dt(e.rotate)}):null,e.origin===`console`?(0,Y.jsx)(`span`,{className:`font-mono text-[10px] text-muted-foreground`,children:`console`}):null,(0,Y.jsx)(`span`,{className:`font-mono text-[10px] text-muted-foreground`,children:We(i)})]}),subtitle:(0,Y.jsxs)(Y.Fragment,{children:[(0,Y.jsx)(`code`,{className:`min-w-0 truncate font-mono text-[11px] leading-none text-foreground/80`,children:e.name}),(0,Y.jsx)(ke,{value:e.name,label:`Copy ${e.name}`})]}),actions:(0,Y.jsxs)(Y.Fragment,{children:[(0,Y.jsx)(Et,{row:e}),_?null:(0,Y.jsx)(I,{label:e.kind===`config`?`Updates this vault.config value. Console shows it in the clear.`:`Write-only. The new value is never shown again.`,className:`flex self-stretch`,children:(0,Y.jsx)(y,{type:`button`,variant:`ghost`,size:`sm`,className:`h-full rounded-none`,onClick:a,children:`Set`})}),_||v?null:(0,Y.jsx)(I,{label:l.warn?l.summary:`Re-encrypt with a new value. Review the fingerprint before it writes.`,className:`flex self-stretch`,children:(0,Y.jsx)(y,{type:`button`,variant:`destructive`,size:`sm`,className:`h-full rounded-none`,disabled:l.warn,onClick:o,children:`Rotate`})})]})}),(0,Y.jsx)(Dt,{row:e,env:t,postureUnset:u.unset,blastWarn:l.warn,blastSummary:l.summary,blastDetail:l.detail,overdue:u.overdue,onSet:a,onRotate:o}),(0,Y.jsxs)(`div`,{className:P,"data-slot":`vault-briefing`,role:`group`,"aria-label":`Posture`,children:[(0,Y.jsx)(X,{label:`from`,value:e.winner?vt[e.winner]:`none`,hint:m?e.winner===`driver`?Ye(i):`First layer that had a value`:`No layer provided a value`,warn:!e.winner,won:!!e.winner,onClick:s?()=>s(e.winner?`from:${e.winner}`:`is:unset`):void 0}),(0,Y.jsx)(X,{label:`read`,value:e.lastReadAt==null?`never`:ht(e.lastReadAt,n),hint:e.lastReadAt==null?`Possible dead secret`:new Date(e.lastReadAt).toISOString(),warn:e.lastReadAt==null&&e.kind===`secret`,onClick:s?()=>s(`is:dormant`):void 0}),(0,Y.jsx)(X,{label:`readers`,value:String(e.readers.length),hint:e.readers.length===0?`No Flow declares a read`:e.readers.join(`, `),onClick:s&&e.readers[0]?()=>s(`reader:${e.readers[0]}`):void 0}),(0,Y.jsx)(X,{label:`blast`,value:e.blastRadius.count===0?`clear`:`${e.blastRadius.count} run${e.blastRadius.count===1?``:`s`}`,hint:l.detail??(e.blastRadius.longestOutstandingMs==null?l.summary:$e(e.blastRadius.longestOutstandingMs)),warn:l.warn,onClick:s?()=>s(`is:blast`):void 0}),e.sharedFingerprintEnvs.length>0?(0,Y.jsx)(X,{label:`shared`,value:e.sharedFingerprintEnvs.join(`, `),hint:`Same fingerprint in another environment`,warn:!0,onClick:s?()=>s(`is:shared`):void 0}):null]}),(0,Y.jsx)(kt,{steps:p,selected:b,fill:x,backend:i,onSelect:g}),(0,Y.jsxs)(`section`,{className:`shrink-0 border-b border-border/60`,"aria-label":`Fingerprints by environment`,children:[(0,Y.jsx)(Ot,{title:e.sensitive?`Fingerprints`:`Value`,meta:e.sensitive?`${f.length} env`:t}),e.sensitive?(0,Y.jsx)(At,{slots:f,env:t}):(0,Y.jsx)(`p`,{className:`px-2 py-1.5 font-mono text-[12px]`,role:`status`,children:e.cleartext??`unset`})]}),(0,Y.jsx)(Mt,{readers:e.readers,name:e.name,onFilterReader:s?e=>s(`reader:${e}`):void 0})]})}function Et({row:e}){let t=[{id:`fx`,label:`Flow read`,value:et(e.name)},{id:`set`,label:`oke vault set`,value:tt(e.name)},{id:`rotate`,label:`oke vault rotate`,value:nt(e.name)},{id:`env`,label:`.env assignment`,value:rt(e.name)},{id:`json`,label:`Export fingerprints`,value:JSON.stringify(at(e),null,2)}];return(0,Y.jsxs)(Fe,{children:[(0,Y.jsx)(I,{label:`Copy snippets (no secret values)`,className:`flex self-stretch`,children:(0,Y.jsx)(je,{render:e=>(0,Y.jsx)(`button`,{...e,type:`button`,"aria-label":`Copy`,className:ae,children:(0,Y.jsx)(r,{icon:De,className:`size-3.5`})})})}),(0,Y.jsxs)(Pe,{align:`end`,className:`min-w-52`,children:[(0,Y.jsx)(Me,{children:t.slice(0,4).map(e=>(0,Y.jsx)(V,{onClick:()=>{navigator.clipboard?.writeText(e.value)},children:e.label},e.id))}),(0,Y.jsx)(Ne,{}),(0,Y.jsx)(V,{onClick:()=>{navigator.clipboard?.writeText(t[4].value)},children:`Export fingerprints`})]})]})}function Dt({row:e,env:t,postureUnset:n,blastWarn:r,blastSummary:i,blastDetail:a,overdue:s,onSet:c,onRotate:l}){return r?(0,Y.jsxs)(`section`,{className:`shrink-0 border-b border-destructive/25 bg-destructive/5`,"aria-label":`Rotation blast radius`,role:`alert`,children:[(0,Y.jsx)(`div`,{className:o(P,`border-b-0`),children:(0,Y.jsxs)(`p`,{className:`flex min-w-0 flex-1 items-center px-2 text-[12px] text-destructive`,children:[i,a?(0,Y.jsxs)(`span`,{className:`text-muted-foreground`,children:[` · `,a]}):null]})}),e.blastRadius.runIds.length>0?(0,Y.jsx)(`ul`,{children:e.blastRadius.runIds.map(e=>(0,Y.jsx)(`li`,{children:(0,Y.jsx)(Le,{to:`/overview`,search:{run:e},className:o(O,`text-destructive`),children:(0,Y.jsx)(`span`,{className:`min-w-0 truncate font-mono text-[11px]`,children:e})})},e))}):null]}):n?(0,Y.jsxs)(`section`,{className:o(P,`border-amber-500/25 bg-amber-500/5`),"aria-label":`Unset contract`,role:`status`,children:[(0,Y.jsxs)(`p`,{className:`flex min-w-0 flex-1 items-center px-2 text-[12px] text-amber-900 dark:text-amber-300`,children:[`No value in `,t,e.readers[0]?(0,Y.jsxs)(`span`,{className:`text-muted-foreground`,children:[` `,`· `,(0,Y.jsx)(`span`,{className:`font-mono`,children:e.readers[0]}),` will fail boot`]}):(0,Y.jsx)(`span`,{className:`text-muted-foreground`,children:` · boot gap until a layer provides one`})]}),(0,Y.jsx)(y,{type:`button`,size:`sm`,onClick:c,className:`h-full shrink-0 rounded-none`,children:`Set`})]}):s&&q(e.rotate)?(0,Y.jsxs)(`section`,{className:o(P,`border-amber-500/25 bg-amber-500/5`),"aria-label":`Rotation overdue`,role:`status`,children:[(0,Y.jsxs)(`p`,{className:`flex min-w-0 flex-1 items-center px-2 text-[12px] text-amber-900 dark:text-amber-300`,children:[`Past rotate `,e.rotate,(0,Y.jsx)(`span`,{className:`text-muted-foreground`,children:` · blast is clear`})]}),(0,Y.jsx)(y,{type:`button`,variant:`destructive`,size:`sm`,onClick:l,className:`h-full shrink-0 rounded-none`,children:`Rotate`})]}):null}function Ot({title:e,meta:t,children:n}){return(0,Y.jsxs)(`header`,{className:o(P,`items-center gap-2 px-2`),children:[(0,Y.jsx)(`h3`,{className:o(C,`shrink-0 leading-none`),children:e}),n,t?(0,Y.jsx)(`span`,{className:`ml-auto shrink-0 font-mono text-[10px] leading-none tabular-nums text-muted-foreground`,children:t}):null]})}function X({label:e,value:t,hint:n,warn:r=!1,won:i=!1,onClick:a}){let s=o(S,N,`gap-1.5`),c=(0,Y.jsxs)(Y.Fragment,{children:[(0,Y.jsx)(`span`,{className:`tracking-[0.08em] uppercase`,children:e}),(0,Y.jsx)(`span`,{className:o(`font-mono tabular-nums text-foreground`,r&&`text-amber-800 dark:text-amber-400`,i&&bt),children:t})]});return a?(0,Y.jsx)(`button`,{type:`button`,title:n,onClick:a,className:s,children:c}):(0,Y.jsx)(`span`,{title:n,className:s,children:c})}function kt({steps:e,selected:t,fill:n,backend:i,onSelect:a}){let s=e.findIndex(e=>e.won);return(0,Y.jsxs)(`section`,{className:`shrink-0 border-b border-border/60`,"aria-label":`Resolution chain`,children:[(0,Y.jsx)(Ot,{title:`Resolution`,meta:`first hit wins`}),(0,Y.jsxs)(`ol`,{className:`relative`,"data-slot":`vault-lock-path`,children:[(0,Y.jsx)(`span`,{className:`pointer-events-none absolute top-3 bottom-3 left-[15px] w-px bg-border/60`,"aria-hidden":!0}),e.map((e,c)=>{let l=e.source===t.source,u=wt(e,c,s);return(0,Y.jsxs)(`li`,{children:[(0,Y.jsxs)(`button`,{type:`button`,"aria-pressed":l,onClick:()=>a(e.source),className:o(O,l&&`bg-muted/70 text-foreground`,s>=0&&c>s&&!l&&`opacity-50`),children:[(0,Y.jsx)(`span`,{className:o(oe,l&&`bg-sky-500`),"aria-hidden":!0}),(0,Y.jsx)(`span`,{className:o(`relative z-10 size-2 shrink-0 rounded-full border`,u===`won`&&`border-emerald-500 bg-emerald-500`,u===`shadowed`&&`border-muted-foreground/50 bg-muted-foreground/40`,u===`missed`&&`border-muted-foreground/50 bg-transparent`,u===`skipped`&&`border-border bg-transparent`),"aria-hidden":!0}),(0,Y.jsx)(r,{icon:yt[e.source],className:o(k,u===`won`?bt:`text-muted-foreground`),"aria-hidden":!0}),(0,Y.jsxs)(`span`,{className:o(`min-w-0 flex-1 truncate font-mono`,u===`won`?bt:`text-foreground`),children:[vt[e.source],e.source===`driver`?(0,Y.jsx)(`span`,{className:`ml-1.5 font-sans text-[10px] text-muted-foreground`,children:We(i)}):null]}),(0,Y.jsx)(`span`,{className:o(`shrink-0 text-[10px]`,u===`won`?bt:`text-muted-foreground`),children:u})]}),l?(0,Y.jsxs)(`div`,{className:`flex items-center gap-2 border-b border-border/60 py-1.5 pr-2 pl-8`,children:[(0,Y.jsx)(`p`,{className:`min-w-0 flex-1 truncate font-mono text-[11px] text-muted-foreground`,children:n.command}),(0,Y.jsx)(`span`,{className:`hidden min-w-0 truncate text-[10px] text-muted-foreground sm:inline`,children:n.hint}),(0,Y.jsx)(ke,{value:n.command,label:`Copy ${e.source} fill`})]}):null]},e.source)})]}),(0,Y.jsxs)(`p`,{className:`sr-only`,children:[`Winner: `,e.find(e=>e.won)?.source??`none`,`. `,n.hint]})]})}function At({slots:e,env:t}){return(0,Y.jsx)(`ul`,{"data-slot":`vault-fingerprints`,children:e.map(e=>(0,Y.jsxs)(`li`,{className:O,children:[(0,Y.jsxs)(`span`,{className:`shrink-0 font-mono text-[11px] text-muted-foreground`,children:[e.env,e.env===t?(0,Y.jsx)(`span`,{className:`ml-1 text-[10px] text-muted-foreground`,children:`this`}):null]}),e.fp?(0,Y.jsx)(`span`,{className:`min-w-0 flex-1 truncate font-mono text-[11px]`,children:e.fp}):(0,Y.jsx)(`span`,{className:`min-w-0 flex-1 text-[11px] text-muted-foreground`,children:`—`}),e.shared?(0,Y.jsxs)(`span`,{role:`status`,className:`shrink-0 text-[10px] text-amber-800 dark:text-amber-400`,children:[`matches `,t]}):null,e.fp?(0,Y.jsx)(ke,{value:e.fp,label:`Copy ${e.env} fingerprint`}):null]},e.env))})}function jt(e,t){let n=new Set,r=[],i=(t,i)=>{n.has(t)||(n.add(t),r.push({env:t,fp:i,shared:i!=null&&e.sharedFingerprintEnvs.includes(t)}))};i(t,e.fingerprint);for(let[t,n]of Object.entries(e.fingerprints))i(t,n);return r}function Mt({readers:e,name:t,onFilterReader:n}){return(0,Y.jsxs)(`section`,{className:`shrink-0 border-b border-border/60`,"aria-label":`Readers`,children:[(0,Y.jsx)(Ot,{title:`Readers`,meta:String(e.length),children:(0,Y.jsx)(`code`,{className:`min-w-0 truncate font-mono text-[10px] leading-none text-muted-foreground`,children:et(t)})}),e.length===0?(0,Y.jsx)(`p`,{className:`px-2 py-1.5 text-[11px] text-muted-foreground`,children:`None declared.`}):(0,Y.jsx)(`ul`,{children:e.map(e=>(0,Y.jsx)(`li`,{children:(0,Y.jsxs)(`div`,{className:o(O,`group/reader`),children:[(0,Y.jsx)(r,{icon:L.flow.icon,className:o(k,`text-sky-500`),"aria-hidden":!0}),(0,Y.jsx)(`span`,{className:`min-w-0 flex-1 truncate font-mono text-xs`,children:e}),(0,Y.jsxs)(`div`,{className:o(de,`group-hover/reader:opacity-100 group-focus-within/reader:opacity-100`),children:[n?(0,Y.jsx)(`button`,{type:`button`,className:`shrink-0 text-[10px] text-muted-foreground hover:text-foreground`,onClick:()=>n(e),children:`filter`}):null,(0,Y.jsx)(Le,{to:`/flows`,search:{flow:e},className:`shrink-0 text-[10px] text-muted-foreground hover:text-foreground`,children:`Flows`}),(0,Y.jsx)(Le,{to:`/overview`,search:{flow:e},className:`shrink-0 text-[10px] text-muted-foreground hover:text-foreground`,children:`Graph`})]})]})},e))})]})}function Nt({loading:e=!1,hasContracts:t,query:n,onClearQuery:r,leading:i}){return e?(0,Y.jsx)(`div`,{"data-slot":`vault-overview`,className:`h-full`,children:(0,Y.jsx)(ze,{icon:L.vault.icon,iconClassName:`border-border/70`,title:`Loading vault…`,description:`Reading contracts and posture.`,leading:i})}):(0,Y.jsx)(`div`,{"data-slot":`vault-overview`,className:`h-full`,children:(0,Y.jsx)(ze,{icon:L.vault.icon,iconClassName:`border-border/70`,title:t?`No contracts match`:`No contracts`,leading:i,description:t?(0,Y.jsxs)(Y.Fragment,{children:[`Nothing matches `,(0,Y.jsx)(`span`,{className:`font-mono`,children:n}),`.`,` `,(0,Y.jsx)(`button`,{type:`button`,className:`underline underline-offset-2 hover:text-foreground`,onClick:r,children:`Clear search`})]}):`Declare vault.secret (fingerprinted) or vault.config (shown in the Config band) in the Manifest.`})})}var Pt={secret:`border-indigo-500/40 bg-indigo-500/12 text-indigo-600 dark:text-indigo-300`,config:`border-emerald-500/40 bg-emerald-500/10 text-emerald-700 dark:text-emerald-400`},Ft={secret:L.vault.icon,config:z},It={secret:`fingerprints only`,config:`vault.config · shown in clear`},Lt={blast:`border-destructive/40 bg-destructive/10 text-destructive`,unset:`border-amber-500/40 bg-amber-500/10 text-amber-700 dark:text-amber-400`,overdue:`border-amber-500/40 bg-amber-500/10 text-amber-700 dark:text-amber-400`,shared:`border-amber-500/40 bg-amber-500/10 text-amber-700 dark:text-amber-400`,dormant:`border-zinc-500/35 bg-zinc-500/10 text-zinc-500 dark:text-zinc-400`,healthy:Pt.secret,config:Pt.config},Rt={blast:B,unset:Ae,overdue:be,shared:Ze,dormant:Ae,healthy:L.vault.icon,config:z},zt={blast:`text-destructive`,unset:`text-amber-800 dark:text-amber-400`,overdue:`text-amber-800 dark:text-amber-400`,shared:`text-amber-800 dark:text-amber-400`,dormant:`text-muted-foreground`,healthy:`text-indigo-600 dark:text-indigo-300`,config:`text-emerald-700 dark:text-emerald-400`};function Bt({groups:e,selectedName:t,loading:n=!1,matchCount:i,totalCount:a,now:s,onSelect:c}){let[l,u]=(0,K.useState)({secret:!0,config:!0});return(0,K.useEffect)(()=>{let n=e.find(e=>e.secrets.some(e=>e.name===t));n&&u(e=>e[n.kind]===!1?{...e,[n.kind]:!0}:e)},[e,t]),(0,Y.jsxs)(`div`,{className:`flex min-h-0 flex-1 flex-col overflow-hidden`,"data-slot":`vault-list`,children:[(0,Y.jsxs)(`div`,{className:`min-h-0 flex-1 overflow-y-auto`,children:[n&&e.length===0?(0,Y.jsx)(`p`,{className:j,children:`Loading…`}):null,!n&&e.length===0?(0,Y.jsxs)(`p`,{className:j,children:[`No contracts match. Try `,(0,Y.jsx)(`span`,{className:`font-mono`,children:`is:unset`}),` or clear the search.`]}):null,e.map(e=>{let n=l[e.kind]!==!1;return(0,Y.jsx)(`section`,{"aria-label":e.label,className:se,"data-slot":`vault-kind-band`,"data-kind":e.kind,children:(0,Y.jsxs)(Te,{open:n,onOpenChange:t=>u(n=>({...n,[e.kind]:t})),children:[(0,Y.jsx)(we,{nativeButton:!1,className:ne,"data-slot":`vault-kind-band-toggle`,render:t=>(0,Y.jsxs)(`div`,{...t,children:[(0,Y.jsx)(r,{icon:Ce,className:o(M,!n&&`-rotate-90`),"aria-hidden":!0}),(0,Y.jsx)(r,{icon:Ft[e.kind],className:o(k,D(Pt[e.kind])),"aria-hidden":!0}),(0,Y.jsx)(`span`,{className:o(A,`flex-1`),title:It[e.kind],children:e.label}),(0,Y.jsx)(`span`,{className:ie,children:e.secrets.length})]})}),(0,Y.jsx)(Se,{children:(0,Y.jsx)(`ul`,{className:`flex flex-col`,children:e.secrets.map(e=>(0,Y.jsx)(Vt,{row:e,selected:e.name===t,now:s,onSelect:c},e.name))})})]})},e.kind)})]}),e.length>0?(0,Y.jsx)(`p`,{className:`sr-only`,children:i===a?`${a} contracts`:`${i} of ${a} contracts`}):null]})}function Vt({row:e,selected:t,now:n,onSelect:i}){let a=e.description?.trim()||e.name,s=e.kind===`config`?e.cleartext??`unset`:e.name,c=s!==a,l=pt(e,n),u=l.primary!==`healthy`&&l.primary!==`config`,d=e.readers.length===0?`no readers`:`${e.readers.length} reader${e.readers.length===1?``:`s`}`,f=[e.origin===`console`?`console`:null,e.kind===`secret`&&!q(e.rotate)?`no rotate`:null].filter(e=>e!==null);return(0,Y.jsx)(`li`,{children:(0,Y.jsxs)(`button`,{type:`button`,"aria-current":t?`true`:void 0,"aria-label":`${a}, ${s}, ${d}, ${gt(l.primary)}`,onClick:()=>i(e.name),className:o(O,`items-start py-2`,t&&`bg-muted/70 text-foreground`),children:[(0,Y.jsx)(`span`,{"aria-hidden":!0,className:o(oe,t&&`bg-[var(--vault-accent)]`),style:{"--vault-accent":J}}),(0,Y.jsx)(I,{label:_t(l.primary,e.rotate),children:(0,Y.jsx)(r,{icon:Rt[l.primary],className:o(k,`mt-0.5`,D(Lt[l.primary])),"aria-hidden":!0})}),(0,Y.jsxs)(`span`,{className:`min-w-0 flex-1`,children:[(0,Y.jsxs)(`span`,{className:`flex items-center gap-2`,children:[(0,Y.jsx)(`span`,{className:`min-w-0 flex-1 truncate font-medium text-foreground`,children:a}),u?(0,Y.jsx)(Ht,{posture:l}):null]}),(0,Y.jsxs)(`span`,{className:`mt-0.5 flex min-w-0 items-center gap-1.5 text-[10px] text-muted-foreground`,children:[c?(0,Y.jsx)(`span`,{className:`min-w-0 truncate font-mono`,children:s}):null,c?(0,Y.jsx)(`span`,{"aria-hidden":!0,children:`·`}):null,(0,Y.jsx)(`span`,{className:`shrink-0 tabular-nums`,children:d}),f.map(e=>(0,Y.jsxs)(`span`,{className:`shrink-0`,children:[`· `,e]},e))]})]})]})})}function Ht({posture:e}){return(0,Y.jsx)(`span`,{role:`status`,className:o(`shrink-0 text-[10px] font-medium`,zt[e.primary]),children:gt(e.primary)})}var Ut=new Set([`unset`,`set`,`dormant`,`blast`,`shared`,`overdue`,`unread`,`healthy`]),Wt=new Set([`secret`,`config`]),Gt=new Set([`readers`,`rotate`,`blast`,`shared`]),Kt=[{token:`is:unset`,label:`No value in this environment`},{token:`is:set`,label:`Has a fingerprint or config value`},{token:`is:blast`,label:`In-flight durable runs hold this secret`},{token:`is:shared`,label:`Fingerprint matches another environment`},{token:`is:dormant`,label:`Unread for 90 days, or never`},{token:`is:overdue`,label:`Last read older than rotate — never-read counts`},{token:`is:healthy`,label:`Set, no blast, no shared, not dormant`},{token:`kind:secret`,label:`Sensitive contracts only`},{token:`kind:config`,label:`Non-sensitive config only`},{token:`from:.env.local`,label:`Winner is .env.local`},{token:`from:driver`,label:`Winner is the vault backend (built-in / managed / memory)`},{token:`has:readers`,label:`At least one Flow declares a read`},{token:`has:rotate`,label:`Contract declares a rotate cadence`},{token:`rotate:never`,label:`No rotate cadence (stable secret)`},{token:`reader:`,label:`Flow id contains…`},{token:`fp:`,label:`Fingerprint contains…`}],qt=[`driver`,`process.env`,`.env.local`,`dev-fallback`];function Jt(e){let t=[],n=/"([^"]+)"|(\S+)/g,r;for(;(r=n.exec(e))!==null;){let e=r[1]??r[2]??``;e.length>0&&t.push(e)}return t}function Yt(e){let t=[];for(let n of Jt(e)){let e=nn(n);e?t.push(e):t.push({kind:`text`,value:n})}return{tokens:t,raw:e}}function Xt(e){let t=[],n=[];for(let r of e){if(r.kind===`text`){n.push(sn(r.value)?`"${r.value}"`:r.value);continue}t.push(`${r.kind}:${r.value}`)}return[...t,...n].join(` `).trim()}function Zt(e,t){let n=Yt(e);return Xt(n.tokens.some(e=>e.kind===`is`&&e.value===t)?n.tokens.filter(e=>e.kind!==`is`||e.value!==t):[...n.tokens,{kind:`is`,value:t}])}function Qt(e,t){return Yt(e).tokens.some(e=>e.kind===`is`&&e.value===t)}function $t(e,t,n){if(t.tokens.length===0)return!0;let r=pt(e,n);for(let n of t.tokens)if(!rn(e,n,r))return!1;return!0}function en(e,t){let n=cn(e);if(n===null)return Kt;let r=n.toLowerCase();if(r.startsWith(`is:`)||r===`is`)return Z(Kt.filter(e=>e.token.startsWith(`is:`)),n);if(r.startsWith(`kind:`)||r===`kind`)return Z([{token:`kind:secret`,label:`Sensitive contracts only`},{token:`kind:config`,label:`Non-sensitive config only`}],n);if(r.startsWith(`from:`)||r===`from`)return Z(qt.map(e=>({token:`from:${e}`,label:e===`driver`?`Winner is the vault backend (built-in / managed / memory)`:`Winner is ${e}`})),n);if(r.startsWith(`has:`)||r===`has`)return Z(Kt.filter(e=>e.token.startsWith(`has:`)),n);if(r.startsWith(`reader:`)||r===`reader`){let e=r.startsWith(`reader:`)?r.slice(7):``,n=new Set;for(let r of t)for(let t of r.readers)(e.length===0||t.toLowerCase().includes(e))&&n.add(t);return[...n].slice(0,8).map(e=>({token:`reader:${e}`,label:`Flow that reads this contract`}))}if(r.startsWith(`fp:`)||r===`fp`){let e=r.startsWith(`fp:`)?r.slice(3):``,n=new Set;for(let r of t){for(let t of Object.values(r.fingerprints))(e.length===0||t.toLowerCase().includes(e))&&n.add(t);r.fingerprint&&(e.length===0||r.fingerprint.toLowerCase().includes(e))&&n.add(r.fingerprint)}return[...n].slice(0,8).map(e=>({token:`fp:${e}`,label:`Exact fingerprint`}))}if(r.startsWith(`rotate:`)||r===`rotate`)return Z([{token:`rotate:due`,label:`Last read older than rotate — never-read counts`},{token:`has:rotate`,label:`Contract declares a rotate cadence`},{token:`rotate:never`,label:`No rotate cadence (stable secret)`}],n);let i=r;return Kt.filter(e=>e.token.includes(i)||e.label.toLowerCase().includes(i))}function tn(e,t){if(e.length===0||/\s$/.test(e))return`${e}${t} `.replace(/^\s+/,``);let n=e.lastIndexOf(` `);return n<0?`${t} `:`${e.slice(0,n+1)}${t} `}function nn(e){if(e.startsWith(`"`))return null;let t=e.indexOf(`:`);if(t<=0)return null;let n=e.slice(0,t).toLowerCase(),r=e.slice(t+1);if(r.length===0)return null;if(n===`is`){let e=r.toLowerCase();return Ut.has(e)?{kind:`is`,value:e}:Wt.has(e)?{kind:`kind`,value:e}:null}if(n===`kind`){let e=r.toLowerCase();return Wt.has(e)?{kind:`kind`,value:e}:null}if(n===`from`)return{kind:`from`,value:r.toLowerCase()};if(n===`reader`)return{kind:`reader`,value:r.toLowerCase()};if(n===`fp`)return{kind:`fp`,value:r.toLowerCase()};if(n===`has`){let e=r.toLowerCase();return Gt.has(e)?{kind:`has`,value:e}:null}if(n===`rotate`){let e=r.toLowerCase();return e===`due`?{kind:`is`,value:`overdue`}:{kind:`rotate`,value:e}}return null}function rn(e,t,n){switch(t.kind){case`is`:return n[t.value];case`kind`:return e.kind===t.value;case`from`:return(e.winner??``).toLowerCase()===t.value;case`reader`:return e.readers.some(e=>e.toLowerCase().includes(t.value));case`fp`:return an(e).some(e=>e.includes(t.value));case`has`:return t.value===`readers`?e.readers.length>0:t.value===`rotate`?q(e.rotate):t.value===`blast`?e.blastRadius.count>0:e.sharedFingerprintEnvs.length>0;case`rotate`:return t.value===`never`?e.kind===`secret`&&!q(e.rotate):(e.rotate??``).toLowerCase()===t.value;case`text`:return on(e).includes(t.value.toLowerCase())}}function an(e){let t=Object.values(e.fingerprints).map(e=>e.toLowerCase());return e.fingerprint&&t.push(e.fingerprint.toLowerCase()),t}function on(e){return[e.name,e.description??``,e.winner??``,e.kind,...e.readers,...Object.keys(e.fingerprints),...Object.values(e.fingerprints),e.fingerprint??``,e.sensitive?``:e.cleartext??``].join(`
+`).toLowerCase()}function sn(e){return/\s/.test(e)}function cn(e){if(e.length===0||/\s$/.test(e))return null;let t=Jt(e);return t[t.length-1]??null}function Z(e,t){let n=t.toLowerCase();return e.filter(e=>e.token.toLowerCase().startsWith(n)||e.token.toLowerCase().includes(n))}function ln({card:e,env:t,summary:n,query:r,progress:i,verifyNote:a,onQueryChange:s,onOpenSecurity:c}){return(0,Y.jsxs)(`section`,{"aria-label":`Vault posture`,className:`shrink-0 border-b border-border/60`,"data-slot":`vault-posture-strip`,children:[(0,Y.jsxs)(`div`,{className:`flex min-h-10 flex-wrap items-stretch`,children:[(0,Y.jsx)(`button`,{type:`button`,onClick:c,"aria-label":`Open vault security`,className:`flex items-center px-2 text-left text-xs font-medium text-foreground hover:bg-muted/50`,children:e?.title??`Vault backend`}),(0,Y.jsx)(`span`,{className:`flex items-center px-2 font-mono text-[10px] text-muted-foreground`,children:t}),e?.badges.map(e=>(0,Y.jsxs)(`span`,{role:e.tone===`warn`?`alert`:`status`,className:o(`flex items-center gap-1.5 px-2 text-[10px]`,e.tone===`warn`?`text-amber-800 dark:text-amber-400`:`text-muted-foreground`,e.id===`rewrap`&&`text-[color:var(--vault-accent)]`),style:e.id===`rewrap`?{"--vault-accent":J}:void 0,children:[(0,Y.jsx)(`span`,{"aria-hidden":!0,className:o(`size-1.5 shrink-0 rounded-full`,e.tone===`warn`?`bg-amber-500`:`bg-muted-foreground/50`,e.id===`rewrap`&&`bg-[var(--vault-accent)]`)}),e.label]},e.id)),st.map(e=>{let t=n[e.id],i=Qt(r,e.token);return t===0&&!i?null:(0,Y.jsx)(I,{label:_t(e.id),className:`flex self-stretch`,children:(0,Y.jsxs)(`button`,{type:`button`,"aria-pressed":i,onClick:()=>s(Zt(r,e.token)),className:o(S,i?ee:N,e.tone===`danger`&&!i&&`text-destructive`,e.tone===`warn`&&!i&&`text-amber-800 dark:text-amber-400`),children:[e.label,(0,Y.jsx)(`span`,{className:`font-mono tabular-nums`,children:t})]})},e.id)}),(0,Y.jsx)(`span`,{className:`ml-auto flex items-center px-2 font-mono text-[10px] text-muted-foreground`,children:a??`${n.secrets}s · ${n.config}c`})]}),i?(0,Y.jsxs)(`p`,{className:`border-t border-border/60 px-2 py-1 font-mono text-[11px]`,style:{color:J},role:`status`,"data-slot":`vault-rewrap-progress`,"data-phase":i.phase,children:[i.headline,(0,Y.jsx)(`span`,{className:`ml-2 font-sans text-muted-foreground`,children:i.detail})]}):null]})}function un({query:e,secrets:t,onQueryChange:n}){let r=(0,K.useId)(),i=(0,K.useRef)(null),[a,s]=(0,K.useState)(!1),[c,l]=(0,K.useState)(0),u=(0,K.useMemo)(()=>en(e,t),[e,t]);(0,K.useEffect)(()=>{l(0)},[e]),(0,K.useEffect)(()=>{let e=e=>{i.current?.contains(e.target)||s(!1)};return document.addEventListener(`mousedown`,e),()=>document.removeEventListener(`mousedown`,e)},[]);let d=t=>{n(tn(e,t.token)),s(!0)};return(0,Y.jsxs)(`div`,{ref:i,className:`relative flex h-full min-w-0 flex-1`,"data-slot":`vault-search`,children:[(0,Y.jsx)(F,{"data-slot":`vault-search-input`,value:e,onChange:e=>{n(e.target.value),s(!0)},onFocus:()=>s(!0),onKeyDown:e=>{if(e.key===`Escape`){s(!1);return}if(!a||u.length===0){e.key===`ArrowDown`&&u.length>0&&(e.preventDefault(),s(!0));return}if(e.key===`ArrowDown`){e.preventDefault(),l(e=>(e+1)%u.length);return}if(e.key===`ArrowUp`){e.preventDefault(),l(e=>(e-1+u.length)%u.length);return}e.key===`Enter`&&u[c]&&(e.preventDefault(),d(u[c]))},placeholder:`Search vault…`,"aria-label":`Search vault`,"aria-autocomplete":`list`,"aria-expanded":a,"aria-controls":r,role:`combobox`,title:`name, fingerprint, reader…  is:unset  from:.env.local`}),a&&u.length>0?(0,Y.jsx)(`ul`,{id:r,role:`listbox`,className:`absolute top-full z-30 mt-1 max-h-72 w-[min(20rem,calc(100vw-4rem))] overflow-y-auto rounded-lg border border-border/70 bg-popover p-1 shadow-md`,children:u.map((e,t)=>(0,Y.jsx)(`li`,{role:`option`,"aria-selected":t===c,children:(0,Y.jsxs)(`button`,{type:`button`,onMouseEnter:()=>l(t),onClick:()=>d(e),className:o(`flex w-full items-baseline gap-2 rounded-md px-2 py-1.5 text-left`,t===c&&`bg-muted/70`),children:[(0,Y.jsx)(`span`,{className:`font-mono text-[11px] text-foreground`,children:e.token}),(0,Y.jsx)(`span`,{className:`min-w-0 flex-1 truncate text-[10px] text-muted-foreground`,children:e.label})]})},`${e.token}-${t}`))}):null]})}function dn(e,t=``,n=Date.now()){let r=Yt(t),i=e.filter(e=>$t(e,r,n)),a=[`secret`,`config`],o={secret:`Secrets`,config:`Config`};return a.map(e=>({kind:e,label:o[e],secrets:i.filter(t=>t.kind===e)})).filter(e=>e.secrets.length>0)}function fn(e){let t=e.remaining,n=e.rewrapTargetKekVersion;if(!(t!==null&&t>0||n!==null))return t===0?{phase:2,headline:`KEK v${e.kekVersion} — rotation complete`,detail:`The previous master key no longer opens this vault.`}:null;let r=n??e.kekVersion,i=t??0;return{phase:1,headline:`kek v${e.kekVersion} → v${r}`,detail:i>0?`${i} DEK${i===1?``:`s`} still on the old key. Both master keys stay live.`:`Both master keys stay live until remaining is 0.`}}function pn({masterKey:e,onDismiss:t}){let[n,r]=(0,K.useState)(!1);return(0,Y.jsx)(p,{open:e!==null,onOpenChange:e=>{e||t()},children:(0,Y.jsxs)(h,{side:`right`,showOverlay:!1,className:`sm:max-w-md`,"data-slot":`vault-master-key-sheet`,children:[(0,Y.jsxs)(m,{children:[(0,Y.jsx)(v,{children:`New master key`}),(0,Y.jsx)(_,{children:`Shown once. Store it offline. This Console process does not keep it for you.`})]}),(0,Y.jsxs)(`div`,{className:`flex min-h-0 flex-1 flex-col overflow-y-auto`,children:[(0,Y.jsx)(`p`,{className:`border-b border-border/50 px-4 py-3 font-mono text-[11px] break-all`,children:e}),(0,Y.jsx)(`p`,{className:`px-4 py-3 text-[11px] text-muted-foreground`,role:`status`,children:`Copying puts the key on the clipboard. Anyone with this device can read it until you clear it.`})]}),(0,Y.jsxs)(l,{children:[(0,Y.jsx)(W,{split:!0,disabled:!e,onClick:()=>{e&&(navigator.clipboard?.writeText(e),r(!0))},children:n?`Copied`:`Copy (clipboard warning)`}),(0,Y.jsx)(W,{variant:`destructive`,onClick:()=>{r(!1),t()},children:`I have stored this key`})]})]})})}function mn({open:e,onOpenChange:t,pending:n=!1,error:r,onConfirm:i}){return(0,Y.jsx)(Ue,{open:e,onOpenChange:t,phrase:`ROTATE_MASTER`,title:`Rotate master key`,description:`Generates a new master key and rewraps DEKs in batches. Both keys stay live until remaining is 0. The new key is shown once.`,pending:n,error:r,confirmLabel:`Confirm rotate master`,slot:`vault-rotate-master-sheet`,onConfirm:i})}var hn=[{id:`status`,cmd:`oke vault status`,label:`Backend seal + KEK`},{id:`audit`,cmd:`oke vault audit`,label:`Hash-chained audit log`},{id:`verify`,cmd:`oke vault audit verify`,label:`Verify the chain on disk`},{id:`backup`,cmd:`oke vault backup`,label:`Encrypted backup`},{id:`restore`,cmd:`oke vault restore`,label:`Restore from backup`}];function gn({open:e,onOpenChange:t,card:n,env:r,progress:i,verifyPending:a=!1,verifyNote:s,onVerify:c,onRotateMaster:l,onExport:u}){return(0,Y.jsx)(p,{open:e,onOpenChange:t,children:(0,Y.jsxs)(h,{side:`right`,showOverlay:!1,className:`sm:max-w-md`,"data-slot":`vault-security-sheet`,children:[(0,Y.jsxs)(m,{children:[(0,Y.jsx)(v,{children:`Vault security`}),(0,Y.jsx)(_,{children:`Fingerprints and backend status only. Backup, restore, and unseal stay on the CLI.`})]}),(0,Y.jsxs)(`div`,{className:`flex min-h-0 flex-1 flex-col overflow-y-auto`,children:[(0,Y.jsxs)(`section`,{className:`flex flex-col gap-2 border-b border-border/50 px-4 py-3`,children:[(0,Y.jsx)(`h3`,{className:`text-[10px] font-semibold tracking-[0.12em] text-muted-foreground uppercase`,children:`Backend`}),(0,Y.jsx)(`p`,{className:`text-[12px] font-medium`,children:n?.title??`Unresolved`}),(0,Y.jsx)(`p`,{className:`text-[11px] text-muted-foreground`,children:n?.description??`The server could not resolve a vault backend.`}),(0,Y.jsxs)(`div`,{className:`flex flex-wrap items-center gap-1.5`,children:[(0,Y.jsxs)(`span`,{className:`font-mono text-[10px] text-muted-foreground`,children:[`env `,r]}),n?.badges.map(e=>(0,Y.jsx)(xe,{variant:`outline`,role:e.tone===`warn`?`alert`:`status`,className:o(`h-5 rounded-md text-[10px]`,e.tone===`warn`&&`border-amber-500/35 bg-amber-500/10 text-amber-800 dark:text-amber-400`),children:e.label},e.id))]}),n?.facts.length?(0,Y.jsx)(`dl`,{className:`flex flex-col gap-1`,children:n.facts.map(e=>(0,Y.jsxs)(`div`,{className:`flex justify-between gap-3`,children:[(0,Y.jsx)(`dt`,{className:`text-[10px] tracking-[0.12em] text-muted-foreground uppercase`,children:e.label}),(0,Y.jsx)(`dd`,{className:`font-mono text-[11px]`,children:e.value})]},e.label))}):null,n?.hint?(0,Y.jsx)(`p`,{className:`text-[11px] text-muted-foreground`,role:`status`,children:n.hint}):null,i?(0,Y.jsxs)(`p`,{className:`font-mono text-[11px]`,style:{color:J},role:`status`,children:[i.headline,(0,Y.jsx)(`span`,{className:`ml-2 font-sans text-muted-foreground`,children:i.detail})]}):null]}),(0,Y.jsxs)(`section`,{className:`flex flex-col gap-2 border-b border-border/50 px-4 py-3`,children:[(0,Y.jsx)(`h3`,{className:`text-[10px] font-semibold tracking-[0.12em] text-muted-foreground uppercase`,children:`Actions`}),(0,Y.jsxs)(`div`,{className:`flex flex-col gap-1.5`,children:[(0,Y.jsx)(y,{type:`button`,variant:`outline`,size:`sm`,disabled:a,onClick:c,children:`Verify audit chain`}),s?(0,Y.jsx)(`p`,{className:`text-[11px] text-muted-foreground`,role:`status`,children:s}):null,(0,Y.jsx)(y,{type:`button`,variant:`outline`,size:`sm`,onClick:l,children:`Rotate master key`}),(0,Y.jsx)(y,{type:`button`,variant:`outline`,size:`sm`,onClick:u,children:`Export fingerprints`})]}),(0,Y.jsx)(`p`,{className:`text-[11px] text-muted-foreground`,children:`Master rotation rewraps DEKs in batches. Both keys stay live until remaining is 0. The new key is shown once.`})]}),(0,Y.jsxs)(`section`,{className:`flex flex-col gap-2 px-4 py-3`,children:[(0,Y.jsx)(`h3`,{className:`text-[10px] font-semibold tracking-[0.12em] text-muted-foreground uppercase`,children:`CLI`}),(0,Y.jsx)(`p`,{className:`text-[11px] text-muted-foreground`,children:`The Console never accepts a master key in the HTTP body.`}),(0,Y.jsx)(`ul`,{className:`flex flex-col gap-1`,children:hn.map(e=>(0,Y.jsx)(_n,{cmd:e.cmd,label:e.label},e.id))})]})]})]})})}function _n({cmd:e,label:t}){let[n,i]=(0,K.useState)(!1);return(0,Y.jsxs)(`li`,{className:`flex items-center gap-2`,children:[(0,Y.jsxs)(`div`,{className:`min-w-0 flex-1`,children:[(0,Y.jsx)(`p`,{className:`font-mono text-[11px]`,children:e}),(0,Y.jsx)(`p`,{className:`text-[10px] text-muted-foreground`,children:t})]}),(0,Y.jsx)(y,{type:`button`,variant:`ghost`,size:`icon-xs`,"aria-label":`Copy ${e}`,onClick:()=>{navigator.clipboard?.writeText(e),i(!0),window.setTimeout(()=>i(!1),1200)},children:(0,Y.jsx)(r,{icon:n?d:pe})})]})}function vn({result:e,onClose:t}){let n=e!==null&&e.ok===!1,r=e?.reason===`link`?`prev-hash does not match the previous row`:e?.reason===`payload`?`stored row hash does not match the payload`:`the chain failed verification`;return(0,Y.jsx)(p,{open:n,onOpenChange:e=>{e||t()},children:(0,Y.jsxs)(h,{side:`right`,showOverlay:!1,className:`sm:max-w-md`,"data-slot":`vault-verify-sheet`,children:[(0,Y.jsxs)(m,{children:[(0,Y.jsx)(v,{children:`Chain broken`}),(0,Y.jsxs)(_,{children:[`The audit hash chain failed at`,` `,(0,Y.jsx)(`span`,{className:`font-mono`,children:e?.brokenAt??`unknown`}),`.`]})]}),(0,Y.jsxs)(`div`,{className:`flex min-h-0 flex-1 flex-col overflow-y-auto text-[11px]`,children:[(0,Y.jsxs)(`p`,{className:`border-b border-border/50 px-4 py-3`,role:`alert`,children:[`Reason: `,r,`.`]}),e?.row?(0,Y.jsxs)(`dl`,{className:`divide-y divide-border/50`,children:[(0,Y.jsx)(Q,{label:`id`,value:e.row.id,mono:!0}),(0,Y.jsx)(Q,{label:`seq`,value:String(e.row.seq),mono:!0}),(0,Y.jsx)(Q,{label:`action`,value:e.row.action}),(0,Y.jsx)(Q,{label:`path`,value:e.row.path??`—`,mono:!0}),(0,Y.jsx)(Q,{label:`actor`,value:`${e.row.actorType} ${e.row.actorId??``}`}),(0,Y.jsx)(Q,{label:`time`,value:new Date(e.row.createdAt).toISOString(),mono:!0}),e.row.errorMessage?(0,Y.jsx)(Q,{label:`error`,value:e.row.errorMessage}):null]}):null]}),(0,Y.jsx)(l,{children:(0,Y.jsx)(W,{onClick:t,children:`Close`})})]})})}function Q({label:e,value:t,mono:n}){return(0,Y.jsxs)(`div`,{className:`px-4 py-2.5`,children:[(0,Y.jsx)(`dt`,{className:`text-[10px] font-semibold tracking-[0.12em] text-muted-foreground uppercase`,children:e}),(0,Y.jsx)(`dd`,{className:n?`font-mono text-[11px] break-all`:`text-[11px]`,children:t})]})}async function yn(e){let t=await crypto.subtle.digest(`SHA-256`,new TextEncoder().encode(e));return`sha256:${[...new Uint8Array(t)].map(e=>e.toString(16).padStart(2,`0`)).join(``).slice(0,16)}`}async function bn(e){let t=e.name.trim(),n=e.value;if(t.length===0)return{error:`Name is required`};if(n.trim().length===0)return{error:`Value is required`};if(e.action!==`create`&&(e.reason?.trim()??``).length<3)return{error:`Reason is required`};let r=e.kind??(e.sensitive?`secret`:`config`),i=await yn(n),a=e.action===`create`?null:e.reason?.trim()??null;return{action:e.action,name:t,kind:r,fingerprint:i,preview:e.sensitive?null:n,reason:a,rotate:e.rotate??null,commit:{name:t,value:n,reason:a,kind:r,description:e.description?.trim()??``,rotate:e.rotate??(r===`secret`?`90d`:`never`)}}}function xn(e,t){return e===null?null:t(e)}function Sn(){return null}function Cn(e){return g(`alert-dialog`,e)}function wn({...e}){return(0,Y.jsx)(Cn,{"data-slot":`alert-dialog`,...e})}function Tn({...e}){return(0,Y.jsx)(f,{"data-slot":`alert-dialog-portal`,...e})}function En({className:e,...t}){return(0,Y.jsx)(c,{"data-slot":`alert-dialog-overlay`,className:o(`fixed inset-0 z-50 bg-black/20 transition-opacity duration-150 data-ending-style:opacity-0 data-starting-style:opacity-0 supports-backdrop-filter:backdrop-blur-xs`,e),...t})}function Dn({className:e,children:t,...n}){return(0,Y.jsxs)(Tn,{children:[(0,Y.jsx)(En,{}),(0,Y.jsx)(s,{"data-slot":`alert-dialog-content`,className:o(`fixed top-1/2 left-1/2 z-50 w-[min(100%-2rem,24rem)] -translate-x-1/2 -translate-y-1/2 overflow-hidden rounded-none border border-border bg-popover text-sm text-popover-foreground shadow-lg outline-none transition duration-150 data-ending-style:scale-95 data-ending-style:opacity-0 data-starting-style:scale-95 data-starting-style:opacity-0`,e),...n,children:t})]})}function On({className:e,...t}){return(0,Y.jsx)(`div`,{"data-slot":`alert-dialog-header`,className:o(`flex flex-col gap-1 border-b border-border/50 px-4 py-3`,e),...t})}function kn({className:e,...t}){return(0,Y.jsx)(`div`,{"data-slot":`alert-dialog-footer`,className:o(`flex flex-row items-stretch border-t border-border/50 p-0`,e),...t})}function An({className:e,...t}){return(0,Y.jsx)(u,{"data-slot":`alert-dialog-title`,className:o(`text-sm font-medium text-foreground`,e),...t})}function jn({className:e,...t}){return(0,Y.jsx)(b,{"data-slot":`alert-dialog-description`,className:o(`text-[11px] text-muted-foreground`,e),...t})}var Mn={create:`Confirm add`,set:`Confirm set`,rotate:`Confirm rotate`},Nn={create:`Add contract`,set:`Set value`,rotate:`Rotate`};function Pn({review:e,pending:t=!1,onCancel:n,onConfirm:r}){return(0,Y.jsx)(wn,{open:e!==null,onOpenChange:e=>{!e&&!t&&n()},children:(0,Y.jsxs)(Dn,{"data-slot":`vault-write-review`,children:[(0,Y.jsxs)(On,{children:[(0,Y.jsx)(An,{children:e?`${Mn[e.action]} ${e.name}`:`Confirm write`}),(0,Y.jsx)(jn,{children:e?.preview==null?`Write-only. The value is never shown again.`:`Config is shown in the clear after submit.`})]}),e?(0,Y.jsx)(Fn,{review:e}):null,(0,Y.jsxs)(kn,{children:[(0,Y.jsx)(W,{split:!0,onClick:n,disabled:t,"data-slot":`vault-write-review-cancel`,children:`Cancel`}),(0,Y.jsx)(W,{variant:e?.action===`rotate`?`destructive`:`default`,disabled:t||e===null,onClick:r,"data-slot":`vault-write-review-confirm`,children:t?`Working…`:e?Nn[e.action]:`Confirm`})]})]})})}function Fn({review:e}){return(0,Y.jsxs)(`dl`,{className:`flex flex-col`,"data-slot":`vault-write-review-facts`,children:[(0,Y.jsx)($,{label:`Name`,value:e.name,mono:!0}),e.action===`create`?(0,Y.jsx)($,{label:`Kind`,value:e.kind}):null,(0,Y.jsx)($,{label:`Fingerprint`,value:e.fingerprint,mono:!0}),e.preview==null?null:(0,Y.jsx)($,{label:`Value`,value:e.preview,mono:!0}),e.reason?(0,Y.jsx)($,{label:`Reason`,value:e.reason}):null,e.action===`create`&&e.rotate?(0,Y.jsx)($,{label:`Rotate`,value:e.rotate}):null]})}function $({label:e,value:t,mono:n=!1}){return(0,Y.jsxs)(`div`,{className:`flex items-baseline justify-between gap-3 border-b border-border/50 px-4 py-2 last:border-b-0`,children:[(0,Y.jsx)(`dt`,{className:`shrink-0 text-[10px] font-semibold tracking-[0.12em] text-muted-foreground uppercase`,children:e}),(0,Y.jsx)(`dd`,{className:n?`min-w-0 truncate font-mono text-[11px]`:`min-w-0 truncate text-[12px]`,children:t})]})}function In({open:e,onOpenChange:t,pending:n=!1,error:r,onSubmit:i}){let[s,c]=(0,K.useState)(`secret`),[u,d]=(0,K.useState)(``),[f,g]=(0,K.useState)(``),[y,b]=(0,K.useState)(`90d`),[x,S]=(0,K.useState)(``),[C,w]=(0,K.useState)(null),[T,E]=(0,K.useState)(null);(0,K.useEffect)(()=>{e||(c(`secret`),d(``),g(``),b(`90d`),S(``),w(null),E(null))},[e]);let D=u.trim().length>0&&x.trim().length>0&&!n,ee=async()=>{let e=await bn({action:`create`,name:u.trim(),value:x,sensitive:s===`secret`,kind:s,description:f.trim(),rotate:s===`secret`?y:`never`});if(`error`in e){w(e.error);return}w(null),E(e)};return(0,Y.jsxs)(p,{open:e,onOpenChange:t,children:[(0,Y.jsxs)(h,{side:`right`,showOverlay:!1,className:`gap-0 p-0 data-[side=right]:sm:max-w-md`,"data-slot":`vault-create-sheet`,children:[(0,Y.jsxs)(m,{className:`gap-1 border-b border-border/50`,children:[(0,Y.jsx)(v,{className:`text-sm`,children:`Add vault contract`}),(0,Y.jsx)(_,{className:`text-[11px]`,children:s===`secret`?`Writes the value and lists the contract here. Promote it to vault.secret in source when a Flow should read it.`:`vault.config — shown in the clear on the Config band after submit.`})]}),(0,Y.jsxs)(`div`,{className:`flex min-h-0 flex-1 flex-col overflow-y-auto`,children:[(0,Y.jsxs)(Be,{label:`Kind`,children:[(0,Y.jsx)(H,{active:s===`secret`,onClick:()=>c(`secret`),children:`secret`}),(0,Y.jsx)(H,{active:s===`config`,onClick:()=>c(`config`),children:`config`})]}),(0,Y.jsx)(U,{label:`Name`,children:(0,Y.jsx)(a,{value:u,onChange:e=>d(e.target.value.toUpperCase().replace(/[^A-Z0-9_]/g,``)),placeholder:`STRIPE_KEY`,autoComplete:`off`,"aria-label":`Contract name`,flat:!0,className:o(G,`font-mono`)})}),(0,Y.jsx)(U,{label:`Description`,children:(0,Y.jsx)(a,{value:f,onChange:e=>g(e.target.value),placeholder:`Optional title`,autoComplete:`off`,"aria-label":`Description`,flat:!0,className:G})}),s===`secret`?(0,Y.jsxs)(Be,{label:`Rotate`,children:[(0,Y.jsx)(H,{active:y===`90d`,onClick:()=>b(`90d`),children:`90d`}),(0,Y.jsx)(H,{active:y===`never`,onClick:()=>b(`never`),children:`no rotate`})]}):null,(0,Y.jsx)(U,{label:`Value`,children:(0,Y.jsx)(a,{type:`password`,autoComplete:`off`,value:x,onChange:e=>S(e.target.value),placeholder:s===`secret`?`Paste the secret`:`Public value`,"aria-label":`New vault value`,flat:!0,className:G})}),C||r?(0,Y.jsx)(Ve,{slot:`vault-create-error`,children:C??r}):null]}),(0,Y.jsxs)(l,{children:[(0,Y.jsx)(W,{split:!0,onClick:()=>t(!1),disabled:n,children:`Cancel`}),(0,Y.jsx)(W,{variant:`default`,disabled:!D,onClick:()=>{ee()},"data-slot":`vault-create-submit`,children:s===`secret`?`Review secret`:`Review config`})]})]}),(0,Y.jsx)(Pn,{review:T,pending:n,onCancel:()=>E(Sn()),onConfirm:()=>{xn(T,e=>{i({name:e.commit.name,value:e.commit.value,kind:e.commit.kind,description:e.commit.description,rotate:e.commit.rotate})})}})]})}var Ln=[{id:`first`,label:`first`,text:`Initial value`},{id:`fix`,label:`fix`,text:`Correct a bad value`},{id:`provider`,label:`provider`,text:`Provider changed it`},{id:`other`,label:`other`,text:``}],Rn=[{id:`scheduled`,label:`scheduled`,text:`Scheduled rotation`},{id:`leak`,label:`leak`,text:`Key compromise`},{id:`provider`,label:`provider`,text:`Provider rotated`},{id:`other`,label:`other`,text:``}];function zn(e){return e===`rotate`?Rn:Ln}function Bn(e){return e===`rotate`?`scheduled`:`first`}function Vn(e,t,n){return t===`other`?n.trim():zn(e).find(e=>e.id===t)?.text??``}function Hn({open:e,onOpenChange:t,mode:n,name:r,sensitive:i=!0,pending:o=!1,error:s,onSubmit:c}){let[u,d]=(0,K.useState)(``),[f,g]=(0,K.useState)(()=>Bn(n)),[y,b]=(0,K.useState)(``),[x,S]=(0,K.useState)(null),[C,w]=(0,K.useState)(null);(0,K.useEffect)(()=>{e||(d(``),g(Bn(n)),b(``),S(null),w(null))},[e,n]);let T=Vn(n,f,y),E=u.trim().length>0&&T.length>=3&&!o,D=zn(n),ee=async()=>{let e=await bn({action:n,name:r,value:u,sensitive:i,reason:T,kind:i?`secret`:`config`});if(`error`in e){S(e.error);return}S(null),w(e)};return(0,Y.jsxs)(p,{open:e,onOpenChange:t,children:[(0,Y.jsxs)(h,{side:`right`,showOverlay:!1,className:`gap-0 p-0 data-[side=right]:sm:max-w-md`,"data-slot":`vault-write-sheet`,children:[(0,Y.jsxs)(m,{className:`gap-1 border-b border-border/50`,children:[(0,Y.jsx)(v,{className:`text-sm`,children:n===`set`?`Set ${r}`:`Rotate ${r}`}),(0,Y.jsx)(_,{className:`text-[11px]`,children:i?`Write-only. The new value is never shown again after submit.`:`This vault.config value is shown in the clear on the Config band after submit.`})]}),(0,Y.jsxs)(`div`,{className:`flex min-h-0 flex-1 flex-col overflow-y-auto`,children:[(0,Y.jsx)(U,{label:`New value`,children:(0,Y.jsx)(a,{type:`password`,autoComplete:`off`,value:u,onChange:e=>d(e.target.value),placeholder:i?`Paste the new secret`:`Paste the new value`,"aria-label":`New vault value`,flat:!0,className:G})}),(0,Y.jsx)(Be,{label:`Reason`,children:D.map(e=>(0,Y.jsx)(H,{active:f===e.id,onClick:()=>g(e.id),children:e.label},e.id))}),f===`other`?(0,Y.jsx)(U,{label:`Other`,children:(0,Y.jsx)(a,{value:y,onChange:e=>b(e.target.value),placeholder:`Why is this change needed?`,"aria-label":`Custom reason`,flat:!0,className:G})}):null,x||s?(0,Y.jsx)(Ve,{slot:`vault-write-error`,children:x??s}):null]}),(0,Y.jsxs)(l,{children:[(0,Y.jsx)(W,{split:!0,onClick:()=>t(!1),disabled:o,children:`Cancel`}),(0,Y.jsx)(W,{variant:n===`rotate`?`destructive`:`default`,disabled:!E,onClick:()=>{ee()},"data-slot":`vault-write-submit`,children:n===`set`?`Review set`:`Review rotate`})]})]}),(0,Y.jsx)(Pn,{review:C,pending:o,onCancel:()=>w(Sn()),onConfirm:()=>{xn(C,e=>{c({value:e.commit.value,reason:e.commit.reason??T})})}})]})}function Un(){let e=Ke(),t=i(),{query:n,selectedName:a,action:s,setQuery:c,setSelectedName:l,setAction:u}=Re(),d=_e(),f=(0,Y.jsx)(ve,{open:d.open,onToggle:d.toggle,noun:`vault`,controlsId:`vault-list`,dataSlot:`vault-list-toggle`}),[p]=(0,K.useState)(()=>Date.now()),[m,h]=(0,K.useState)(!1),[g,_]=(0,K.useState)(null),[v,y]=(0,K.useState)(null),[b,S]=(0,K.useState)(null),[C,D]=(0,K.useState)(null),[ee,O]=(0,K.useState)(null),[ne,ie]=(0,K.useState)(null),[k,oe]=(0,K.useState)(null),[se,A]=(0,K.useState)(null),j=e.data?.secrets??[],de=e.data?.env??`dev`,M=e.data?.backend??null,N=(0,K.useMemo)(()=>Je(M),[M]),P=(0,K.useMemo)(()=>dn(j,n,p),[j,n,p]),pe=(0,K.useMemo)(()=>mt(j,p),[j,p]),F=(0,K.useMemo)(()=>P.flatMap(e=>e.secrets),[P]),L=F.length,R=F.find(e=>e.name===a)??F[0]??null,be=fn({kekVersion:ne??M?.status?.kekVersion??1,remaining:ee,rewrapTargetKekVersion:M?.status?.rewrapTargetKekVersion??null});(0,K.useEffect)(()=>{let e=e=>{if(e.key!==`/`||e.metaKey||e.ctrlKey||e.altKey)return;let t=e.target;if(t instanceof HTMLElement){let e=t.tagName;if(e===`INPUT`||e===`TEXTAREA`||t.isContentEditable)return}e.preventDefault(),document.querySelector(`[data-slot='vault-search-input']`)?.focus()};return window.addEventListener(`keydown`,e),()=>window.removeEventListener(`keydown`,e)},[]);let z=async()=>{await t.invalidateQueries({queryKey:Xe})},xe=()=>{let e=ot(j);navigator.clipboard?.writeText(e),_(`Exported fingerprints only (no secret values)`)},Se=Ie({mutationFn:async e=>{if(e.value.trim().length===0)throw Error(`New value is required`);let t=await(e.mode===`set`?ce:le)({name:e.name,value:e.value,reason:e.reason});if(t.error)throw Error(te(t.error));return t.data},onSuccess:async()=>{y(null),u(null),await z()},onError:e=>{y(e.message)}}),Ce=Ie({mutationFn:async e=>{if(e.name.trim().length===0)throw Error(`Name is required`);if(e.value.trim().length===0)throw Error(`Value is required`);let t=await w({name:e.name,value:e.value,kind:e.kind,...e.description.length>0?{description:e.description}:{},...e.rotate.length>0?{rotate:e.rotate}:{}});if(t.error)throw Error(te(t.error));return t.data},onSuccess:async e=>{y(null),u(null),e?.name&&l(e.name),await z()},onError:e=>{y(e.message)}}),we=Ie({mutationFn:async e=>{let t=0,n=M?.status?.kekVersion??1;for(;;){let r=await x(e);if(r.error)throw Error(te(r.error));if(!r.data)throw Error(`Empty rotate-master response`);if(t=r.data.remaining,n=r.data.kekVersion,O(r.data.remaining),ie(r.data.kekVersion),r.data.masterKey&&D(r.data.masterKey),await z(),r.data.remaining===0)break}return{remaining:t,kekVersion:n}},onSuccess:()=>{S(null),u(null)},onError:e=>{S(e.message)}}),B=Ie({mutationFn:async()=>{let e=await E();if(e.error)throw Error(te(e.error));if(!e.data)throw Error(`Empty verify response`);return e.data},onSuccess:e=>{e.ok?(A(null),oe(`chain intact`)):(oe(null),A(e))}});return(0,Y.jsxs)(`div`,{className:ue,"data-slot":`vault-page`,children:[(0,Y.jsxs)(fe,{orientation:`horizontal`,className:`min-h-0 flex-1`,children:[(0,Y.jsx)(he,{panelRef:d.panelRef,collapsible:!0,collapsedSize:0,defaultSize:re.start.defaultSize,minSize:re.start.minSize,onResize:d.onResize,className:`min-h-0 overflow-hidden`,children:(0,Y.jsxs)(`div`,{id:`vault-list`,className:`flex h-full min-h-0 flex-col overflow-hidden`,"data-slot":`vault-list`,children:[(0,Y.jsxs)(`div`,{className:o(T,`relative z-20 pr-1.5`),children:[(0,Y.jsx)(un,{query:n,secrets:j,onQueryChange:c}),(0,Y.jsx)(I,{label:`Add secret or config`,className:`flex self-stretch`,children:(0,Y.jsx)(`button`,{type:`button`,"aria-label":`Add secret or config`,onClick:()=>u(`create`),className:ae,children:(0,Y.jsx)(r,{icon:Oe,className:`size-3.5`})})}),g?(0,Y.jsx)(`span`,{className:`sr-only`,role:`status`,children:g}):null,(0,Y.jsx)(I,{label:`Verify the audit hash chain`,className:`flex self-stretch`,children:(0,Y.jsx)(`button`,{type:`button`,"aria-label":`Verify chain`,disabled:B.isPending,onClick:()=>B.mutate(),className:ae,children:(0,Y.jsx)(r,{icon:ge,className:`size-3.5`})})}),(0,Y.jsxs)(Fe,{children:[(0,Y.jsx)(I,{label:`Vault security`,className:`flex self-stretch`,children:(0,Y.jsx)(je,{render:e=>(0,Y.jsx)(`button`,{...e,type:`button`,"aria-label":`Vault security`,className:ae,children:(0,Y.jsx)(r,{icon:De,className:`size-3.5`})})})}),(0,Y.jsxs)(Pe,{align:`end`,className:`min-w-52`,children:[(0,Y.jsxs)(Me,{children:[(0,Y.jsx)(V,{onClick:()=>h(!0),children:`Security`}),(0,Y.jsxs)(V,{onClick:()=>u(`rotate-master`),children:[(0,Y.jsx)(r,{icon:me,"data-icon":`inline-start`}),`Rotate master key`]}),(0,Y.jsxs)(V,{onClick:xe,children:[(0,Y.jsx)(r,{icon:Ee,"data-icon":`inline-start`}),`Export fingerprints`]})]}),(0,Y.jsx)(Ne,{}),(0,Y.jsxs)(V,{disabled:B.isPending,onClick:()=>B.mutate(),children:[(0,Y.jsx)(r,{icon:ge,"data-icon":`inline-start`}),`Verify audit chain`]})]})]})]}),(0,Y.jsx)(ln,{card:N,env:de,summary:pe,query:n,progress:be,verifyNote:k,onQueryChange:c,onOpenSecurity:()=>h(!0)}),(0,Y.jsx)(Bt,{groups:P,selectedName:R?.name??a,loading:e.isLoading,matchCount:L,totalCount:j.length,now:p,onSelect:l})]})}),d.open?(0,Y.jsx)(ye,{withHandle:!0}):null,(0,Y.jsx)(he,{defaultSize:re.end.defaultSize,minSize:re.end.minSize,className:`min-h-0 overflow-hidden`,children:R?(0,Y.jsx)(Tt,{row:R,env:de,now:p,backend:M,onSet:()=>u(`set`),onRotate:()=>u(`rotate`),onQueryChange:c,leading:f}):(0,Y.jsx)(Nt,{loading:e.isLoading,hasContracts:j.length>0,query:n,onClearQuery:()=>c(``),leading:f})})]}),(0,Y.jsx)(In,{open:s===`create`,onOpenChange:e=>{e||(y(null),u(null))},pending:Ce.isPending,error:s===`create`?v:null,onSubmit:e=>Ce.mutate(e)}),(0,Y.jsx)(Hn,{open:s===`set`||s===`rotate`,onOpenChange:e=>{e||(y(null),u(null))},mode:s===`rotate`?`rotate`:`set`,name:R?.name??``,sensitive:R?.sensitive??!0,pending:Se.isPending,error:v,onSubmit:e=>{R&&Se.mutate({mode:s===`rotate`?`rotate`:`set`,name:R.name,...e})}}),(0,Y.jsx)(mn,{open:s===`rotate-master`,onOpenChange:e=>{e||(S(null),u(null))},pending:we.isPending,error:b,onConfirm:e=>we.mutate(e)}),(0,Y.jsx)(gn,{open:m,onOpenChange:h,card:N,env:de,progress:be,verifyPending:B.isPending,verifyNote:k,onVerify:()=>B.mutate(),onRotateMaster:()=>{h(!1),u(`rotate-master`)},onExport:xe}),(0,Y.jsx)(pn,{masterKey:C,onDismiss:()=>D(null)}),(0,Y.jsx)(vn,{result:se,onClose:()=>A(null)})]})}export{Un as VaultPage};

package/src/console/ui-next/dist/index.html

@@ -37,13 +37,14 @@
         } catch (e) {}
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-vTuwmeQz.js"></script>
+    <script type="module" crossorigin src="/assets/index-C0lc_s9d.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-hePW80VL.js">
     <link rel="modulepreload" crossorigin href="/assets/react-dom-Ddte4I-Q.js">
     <link rel="modulepreload" crossorigin href="/assets/xyflow-yApv7D4e.js">
-    <link rel="modulepreload" crossorigin href="/assets/shortcut-keys-CUNegEV4.js">
+    <link rel="modulepreload" crossorigin href="/assets/explorer-chrome-Dslh2yE8.js">
+    <link rel="modulepreload" crossorigin href="/assets/shortcut-keys-DTE1sjTC.js">
     <link rel="stylesheet" crossorigin href="/assets/xyflow-CSyC6ryz.css">
-    <link rel="stylesheet" crossorigin href="/assets/index-VxoEz295.css">
+    <link rel="stylesheet" crossorigin href="/assets/index-BlrN49Hs.css">
   </head>
   <body>
     <div id="root"></div>

package/src/console/ui-next/seed-parked-approval.ts

@@ -0,0 +1,126 @@
+/**
+ * Park one durable agent tool approval so the seeded Console can approve it.
+ *
+ * The follow log stays on this app. Console forwards `GET /agent/runs/:runId/events`
+ * here and wakes the run after the operator resolves the approval.
+ */
+
+import { flow, type AnyFlowDef } from "../../kernel/flow.ts";
+import { createMemoryJournalStore, type JournalStore } from "../../kernel/journal.ts";
+import { oke, type OkeApp } from "../../kernel/app.ts";
+import type { Binding } from "../../kernel/on.ts";
+import { http } from "../../kernel/triggers.ts";
+import { ai, createAiRuntime } from "../../elements/ai.ts";
+import { createGateRuntime, gate } from "../../elements/gate.ts";
+import { getAgentEventLog, type AgentEventLog } from "../../elements/ai/run-events.ts";
+
+/** A parked approval the Console queue and follow view can drive. */
+export interface ParkedApproval {
+  readonly store: JournalStore;
+  readonly app: OkeApp;
+  readonly log: AgentEventLog | undefined;
+  /** Resume the durable run after the Console writes the approval. */
+  resume(): Promise<void>;
+  stop(): Promise<void>;
+  /** Proxy the follow route without the Console session. */
+  fetch(request: Request): Promise<Response>;
+}
+
+/**
+ * Boot a tiny app, start one agent run, and leave it sleeping on a tool approval.
+ */
+export async function bootParkedApproval(): Promise<ParkedApproval> {
+  const store = createMemoryJournalStore();
+  const ops = gate.policy("ops", () => true);
+  const runtime = createAiRuntime({
+    journalStore: store,
+    models: [ai.model("smart")],
+    gates: createGateRuntime({ gates: [ops] }),
+    agents: [
+      ai.agent("support", {
+        model: "smart",
+        maxSteps: 4,
+        tools: [{ name: "refund", approval: true, gate: "ops", timeout: "1h" }],
+      }),
+    ],
+    clients: {
+      smart: {
+        driverId: "mock",
+        model: "smart",
+        async complete(opts) {
+          if (opts.messages.some((message) => message.role === "tool")) {
+            return {
+              text: "Refunded.",
+              raw: {},
+              model: "smart",
+              driverId: "mock",
+              usage: { inputTokens: 3, outputTokens: 2, cost: 0 },
+            };
+          }
+          return {
+            text: "",
+            raw: {},
+            model: "smart",
+            driverId: "mock",
+            toolCalls: [{ id: "tc1", name: "refund", arguments: { amount: 10 } }],
+          };
+        },
+      },
+    },
+  });
+  const refund = flow("refund", {
+    do: async (input: { amount?: number }) => ({ refunded: true, amount: input.amount ?? 0 }),
+  });
+  const assist: Binding = {
+    trigger: http.post("/assist"),
+    flow: flow("assist", {
+      durable: true,
+      effects: { asks: ["support"], calls: ["refund"] },
+      do: (_input, fx) =>
+        fx.json.stream(fx.run("support", { message: "refund" }, { stream: true })),
+    }) as AnyFlowDef,
+  };
+  const app = oke({
+    name: "console-seed-approval",
+    env: "test",
+    startScheduler: false,
+    registry: "ignore",
+    gate: { unguardedHttp: "allow", policies: [ops] },
+    bindings: [assist, { trigger: http.post("/refund").public(), flow: refund as AnyFlowDef }],
+    elements: {
+      journal: { store, instanceId: "console-seed-approval", leaseMs: 30_000, driverId: "memory" },
+      ai: runtime,
+    },
+  });
+  await app.boot({ env: "test" });
+  const parked = await app.fetch(
+    new Request("http://localhost/assist", { method: "POST", body: "{}" }),
+  );
+  if (parked.status >= 500) {
+    throw new Error(`seeded approval failed to park (${parked.status})`);
+  }
+  await parked.text();
+  const log = getAgentEventLog();
+  return {
+    store,
+    app,
+    log,
+    async resume() {
+      await app.resumeDurable(Date.now() + 1000);
+    },
+    async stop() {
+      await app.stop();
+    },
+    fetch(request) {
+      const headers = new Headers(request.headers);
+      headers.delete("authorization");
+      headers.delete("cookie");
+      return app.fetch(
+        new Request(request.url, {
+          method: request.method,
+          headers,
+        }),
+      );
+    },
+  };
+}

package/src/console/ui-next/src/client.ts

@@ -331,7 +331,17 @@ export async function gatesList(): Promise<ConsoleApiResult<GatesListPayload>> {
 
 /** Effect entry on a run row (matches server `RunsListOut`). */
 export type RunEffect = {
-  readonly kind: "read" | "write" | "emit" | "send" | "ask" | "embed" | "secret" | "call" | "fetch";
+  readonly kind:
+    | "read"
+    | "write"
+    | "emit"
+    | "send"
+    | "ask"
+    | "embed"
+    | "secret"
+    | "call"
+    | "fetch"
+    | "decide";
   readonly resource: string;
   readonly timestamp: number;
   readonly duration: number;
@@ -347,6 +357,8 @@ export type RunEffect = {
     readonly provider?: string;
     readonly kind?: "third-party" | "infrastructure";
   };
+  /** Agent run started by this `fx.run` or nested agent call. */
+  readonly agentRunId?: string;
 };
 
 /** Log line on a run row (matches server `RunsListOut`). */
@@ -357,6 +369,32 @@ export type RunLog = {
   readonly at: number;
 };
 
+/**
+ * HTTP message stored beside the flow body.
+ *
+ * Credential headers arrive already replaced with `[redacted]`.
+ */
+export type RunHttpFrame = {
+  /** Request line, query, and headers. */
+  readonly request: {
+    /** Verb as received. */
+    readonly method: string;
+    /** Pathname. Query is {@link query}. */
+    readonly path: string;
+    /** Query string. */
+    readonly query: Readonly<Record<string, string>>;
+    /** Lower-case header names. */
+    readonly headers: Readonly<Record<string, string>>;
+  };
+  /** Final response, when the trigger produced one. */
+  readonly response?: {
+    /** Status code. */
+    readonly status: number;
+    /** Lower-case header names. */
+    readonly headers: Readonly<Record<string, string>>;
+  };
+};
+
 /** One run row from `GET /console/runs` (matches server `projectRun`). */
 export type RunRow = {
   readonly id: string;
@@ -396,6 +434,11 @@ export type RunRow = {
    * (failures, sleeps, or legacy rows).
    */
   readonly output: unknown;
+  /**
+   * HTTP wire frame. `null` for non-HTTP runs and rows recorded before the
+   * frame existed.
+   */
+  readonly http?: RunHttpFrame | null;
 };
 
 /** Runs list payload (`GET /console/runs`). */
@@ -672,6 +715,186 @@ export async function aiList(): Promise<ConsoleApiResult<AiListPayload>> {
   return consoleFetch<AiListPayload>("/console/ai");
 }
 
+/** Why an agent run stopped. */
+export type AgentStopReason = "completed" | "max_steps" | "budget" | "denied" | "aborted" | "error";
+
+/** One agent run on `GET /console/ai/runs`. */
+export type AgentRunRow = {
+  readonly id: string;
+  readonly agent: string;
+  readonly status: "running" | "finished" | "error" | "interrupted";
+  readonly stopReason?: AgentStopReason;
+  readonly error?: string;
+  readonly steps: number;
+  readonly cost: number;
+  readonly inputTokens?: number;
+  readonly outputTokens?: number;
+  readonly threadId?: string;
+  readonly startedAt: number;
+  readonly finishedAt?: number;
+  readonly parentRunId?: string;
+  readonly tenant: string | null;
+  readonly message: string;
+  readonly trail: readonly {
+    readonly tool: string;
+    readonly status: "ok" | "denied" | "pending";
+    readonly approver?: string;
+    readonly denial: { readonly gate: string; readonly reason: string } | null;
+    readonly at: number;
+  }[];
+  readonly denials: readonly {
+    readonly tool: string;
+    readonly gate: string;
+    readonly reason: string;
+  }[];
+  readonly repairs: readonly {
+    readonly prompt: string;
+    readonly at: number;
+    readonly attempts: number;
+  }[];
+  readonly children: readonly {
+    readonly id: string;
+    readonly agent: string;
+    readonly status: AgentRunRow["status"];
+    readonly parentRunId?: string;
+  }[];
+};
+
+/** One pending tool approval. */
+export type AgentApprovalRow = {
+  readonly id: string;
+  readonly agent: string;
+  readonly tool: string;
+  readonly args: unknown;
+  readonly requestedAt: number;
+  readonly ageMs: number;
+  readonly gate: string;
+  readonly tenant: string | null;
+  readonly runId: string;
+};
+
+/**
+ * GET /console/ai/runs — agent runs, trails, and the subagent tree.
+ */
+export async function agentRunsList(): Promise<ConsoleApiResult<{ runs: readonly AgentRunRow[] }>> {
+  return consoleFetch<{ runs: readonly AgentRunRow[] }>("/console/ai/runs");
+}
+
+/**
+ * POST /console/ai/approvals/approve — optional edited args must already be JSON.
+ *
+ * @param body - Approval id and optional replacement args
+ */
+export async function agentApprovalApprove(body: {
+  readonly id: string;
+  readonly args?: unknown;
+}): Promise<ConsoleApiResult<{ ok: true }>> {
+  return consoleFetch<{ ok: true }>("/console/ai/approvals/approve", {
+    method: "POST",
+    body: JSON.stringify(body),
+  });
+}
+
+/**
+ * POST /console/ai/approvals/deny.
+ *
+ * @param body - Approval id and optional reason
+ */
+export async function agentApprovalDeny(body: {
+  readonly id: string;
+  readonly reason?: string;
+}): Promise<ConsoleApiResult<{ ok: true }>> {
+  return consoleFetch<{ ok: true }>("/console/ai/approvals/deny", {
+    method: "POST",
+    body: JSON.stringify(body),
+  });
+}
+
+/**
+ * GET /console/ai/approvals — pending tool approvals.
+ */
+export async function agentApprovalsList(): Promise<
+  ConsoleApiResult<{ rows: readonly AgentApprovalRow[] }>
+> {
+  return consoleFetch<{ rows: readonly AgentApprovalRow[] }>("/console/ai/approvals");
+}
+
+/** One decision on `GET /console/decisions`. */
+export type DecisionListRow = {
+  readonly name: string;
+  readonly state: "learning" | "candidate" | "certified" | "suspended";
+  readonly mode: "review" | "abstain";
+  readonly model?: string;
+  readonly metrics?: Readonly<Record<string, number>>;
+  readonly promote?: string;
+};
+
+/** One failed label write, shown on the decisions page. */
+export type DecisionLabelFailure = {
+  readonly decision: string;
+  readonly question: string;
+  readonly message: string;
+  readonly at: number;
+};
+
+/** Decision catalogue, per-decision drift names, and label-write failures. */
+export type DecisionListPayload = {
+  readonly decisions: readonly DecisionListRow[];
+  readonly suspended: readonly string[];
+  readonly failures: readonly DecisionLabelFailure[];
+};
+
+/** One question on the resolve form. */
+export type DecisionFormQuestion = {
+  readonly id: string;
+  readonly kind: "boolean" | "choice" | "score";
+  readonly options?: readonly string[];
+  readonly levels?: readonly string[];
+};
+
+/** One review queue row. `ageMs` is how long it has been waiting. */
+export type DecisionQueueRow = {
+  readonly id: string;
+  readonly decision: string;
+  readonly requestedAt: number;
+  readonly ageMs: number;
+  readonly labelOnly: boolean;
+  readonly status: "pending" | "reviewed";
+  readonly questions: readonly DecisionFormQuestion[];
+};
+
+/**
+ * GET /console/decisions — lockfile state for every declared decision.
+ */
+export async function decisionList(): Promise<ConsoleApiResult<DecisionListPayload>> {
+  return consoleFetch<DecisionListPayload>("/console/decisions");
+}
+
+/**
+ * GET /console/decisions/queue — parked reviews and audit label rows.
+ */
+export async function decisionQueue(): Promise<
+  ConsoleApiResult<{ rows: readonly DecisionQueueRow[] }>
+> {
+  return consoleFetch<{ rows: readonly DecisionQueueRow[] }>("/console/decisions/queue");
+}
+
+/**
+ * POST /console/decisions/resolve — approve a parked review or an audit label.
+ *
+ * @param body - Review id and the value the gate supplies
+ */
+export async function decisionResolve(body: {
+  readonly id: string;
+  readonly values: Readonly<Record<string, unknown>>;
+  readonly labelOnly?: boolean;
+}): Promise<ConsoleApiResult<{ ok: true }>> {
+  return consoleFetch<{ ok: true }>("/console/decisions/resolve", {
+    method: "POST",
+    body: JSON.stringify(body),
+  });
+}
+
 /** Request body for `POST /console/clock/run-now`. */
 export type ClockRunNowInput = {
   readonly name: string;

package/src/console/ui-next/src/components/explorer/detail-header.tsx

@@ -21,6 +21,8 @@ export interface DetailHeaderProps {
   readonly subtitle?: ReactNode;
   /** First control — typically collapse / expand the start explorer. */
   readonly leading?: ReactNode;
+  /** Last control — typically collapse / expand an end rail. */
+  readonly trailing?: ReactNode;
   readonly actions?: ReactNode;
   readonly sticky?: boolean;
   readonly className?: string;
@@ -40,6 +42,7 @@ export function DetailHeader({
   badge,
   subtitle,
   leading,
+  trailing,
   actions,
   sticky = false,
   className,
@@ -77,6 +80,12 @@ export function DetailHeader({
         ) : null}
       </div>
       {actions ? <div className="flex h-full shrink-0 items-stretch">{actions}</div> : null}
+      {trailing ? (
+        <div className="-mr-2 flex h-full shrink-0 items-stretch">
+          <span className="w-px shrink-0 self-stretch bg-border/60" aria-hidden />
+          {trailing}
+        </div>
+      ) : null}
     </header>
   );
 }

package/src/console/ui-next/src/components/explorer/explorer-start-toggle.tsx

@@ -16,6 +16,8 @@ export interface ExplorerStartToggleProps {
   readonly noun: string;
   readonly controlsId: string;
   readonly dataSlot: string;
+  /** `end` mirrors the icon for a right-hand rail. */
+  readonly side?: "start" | "end";
 }
 
 /**
@@ -29,8 +31,10 @@ export function ExplorerStartToggle({
   noun,
   controlsId,
   dataSlot,
+  side = "start",
 }: ExplorerStartToggleProps): JSX.Element {
   const label = open ? `Collapse ${noun}` : `Expand ${noun}`;
+  const collapsedTowardStart = side === "end" ? !open : open;
   return (
     <ToolbarTip label={label} className="flex self-stretch">
       <button
@@ -43,7 +47,7 @@ export function ExplorerStartToggle({
         className={EXPLORER_ICON_BUTTON_CLASS}
       >
         <HugeiconsIcon
-          icon={open ? LayoutAlignLeftIcon : LayoutAlignRightIcon}
+          icon={collapsedTowardStart ? LayoutAlignLeftIcon : LayoutAlignRightIcon}
           className="size-3.5"
         />
       </button>

package/src/console/ui-next/src/components/ui/sheet-form.tsx

@@ -309,31 +309,40 @@ export interface SheetGridProps {
   readonly children: ReactNode;
 }
 
+/** Minimum track so a name plus optional, range, and type badges fit. */
+const SHEET_GRID_MIN = "17rem";
+
+/**
+ * Equal columns that fill the row. Drops a column when a track would be
+ * narrower than {@link SHEET_GRID_MIN}. `columns` is the widest the row goes.
+ */
+function sheetGridTracks(max: 1 | 2 | 3 | 4): string {
+  const floor = `${100 / max}%`;
+  return `repeat(auto-fit, minmax(min(100%, max(${SHEET_GRID_MIN}, ${floor})), 1fr))`;
+}
+
 /**
  * Field grid — equal columns that fill the row; drops as the dock narrows.
  *
+ * Each track stays at least 17rem so a name and its badges fit. The cap
+ * (`columns`) is the widest the row will go. The trailing rule is clipped
+ * so the last column sits flush with the right edge.
+ *
  * @param props - Fields + optional column cap
  */
 export function SheetGrid({ columns = 4, children }: SheetGridProps): JSX.Element {
   const count = Children.count(children);
   const max = Math.min(columns, count) as 1 | 2 | 3 | 4;
   return (
-    <div className="@container w-full min-w-0 max-w-full">
+    <div className="w-full min-w-0 max-w-full overflow-hidden">
       <div
         className={cn(
           "grid w-full min-w-0 grid-cols-1",
-          max >= 2 && "@min-[18rem]:grid-cols-2",
-          max >= 3 && "@min-[26rem]:grid-cols-3",
-          max >= 4 && "@min-[34rem]:grid-cols-4",
-          "[&>*]:min-w-0 [&>*]:border-r [&>*]:border-border/50",
-          max >= 2 && "@min-[18rem]:[&>*:nth-child(2n)]:border-r-0",
-          max >= 3 &&
-            "@min-[26rem]:[&>*:nth-child(2n)]:border-r @min-[26rem]:[&>*:nth-child(3n)]:border-r-0",
-          max >= 4 &&
-            "@min-[34rem]:[&>*:nth-child(2n)]:border-r @min-[34rem]:[&>*:nth-child(3n)]:border-r @min-[34rem]:[&>*:nth-child(4n)]:border-r-0",
-          max < 2 && "[&>*]:border-r-0",
-          "[&>*:last-child]:border-r-0",
+          max >= 2 && "-mr-px w-[calc(100%+1px)]",
+          "[&>*]:min-w-0",
+          max >= 2 && "[&>*]:border-r [&>*]:border-border/50",
         )}
+        style={max >= 2 ? { gridTemplateColumns: sheetGridTracks(max) } : undefined}
       >
         {children}
       </div>